Homeland Security Staff Data Spills Online

TechCrunch reports that records on more than 40,000 DHS employees were published after a breach.

A previously undisclosed breach at the U.S. Department of Homeland Security has exposed personnel data on more than 40,000 employees, including staff at Customs and Border Protection, Immigration and Customs Enforcement, and the Cybersecurity and Infrastructure Security Agency.

TechCrunch reported that the data published online includes names, job titles and work contact details such as email addresses, mobile phone numbers and office locations. The outlet said it reviewed the leaked material and verified part of it by matching several names against known Homeland Security employees. That is not the same thing as a full forensic account of how the breach happened, but it does make this look less like a bluff than a dump of real directory information.

The hacker, using the name “Department of Peace,” claimed the data came from an Okta single sign-on system used across Homeland Security. According to TechCrunch, the dataset also contains IT and account records showing which internal systems and applications some employees were allowed to access. That matters for two reasons at once: because government workers have had their identifying details exposed, and because the leak may also offer a map of parts of the department’s internal digital structure.

Okta said it was aware of the report and that it had no evidence its own systems or data were compromised. Homeland Security did not provide comment to TechCrunch before publication. It remains unclear whether the weakness that enabled the breach has been fixed, whether the department had already detected the intrusion, or whether additional data was taken beyond the records now circulating.

The scale is large enough to be more than an embarrassment. TechCrunch said more than half the records relate to CBP employees, with another 10,000 tied to ICE and Homeland Security Investigations, and just under 1,000 connected to CISA. Exposure of work locations and phone numbers can create direct safety and harassment risks for individual employees, including people whose jobs already place them in politically charged and publicly contentious roles.

The leak also appears to reveal something about the tools the department uses. TechCrunch reported that group memberships in the data reference Microsoft 365, Citrix, Adobe software and surveillance products linked to vendors such as Penlink. Headspace, another company named in the leaked group data, told TechCrunch it has not provided services to DHS or ICE since 2023.

For the people in the files, the breach is not abstract. A government login system is supposed to organize access. In this case, it appears to have become a way of exposing who had it.